A flaw was found in the Kruize Autotune REST API where endpoints that list datasource configurations exposed authentication secrets such as passwords, bearer tokens, API keys, and OAuth2 client secrets in cleartext because the API lacked any authentication layer and used a default serialization configuration. The exposed credentials enable an attacker with network reachability to the Autotune service to harvest them and reuse them to authenticate directly to the backing monitoring stack, potentially giving the attacker full access to monitoring data and control over configuration.

This vulnerability impacts all releases of Kruize Autotune. No specific product version numbers are listed in the advisory, so users should assume all installed instances are affected until a patch is applied.

The CVSS score of 7.4 marks the vulnerability as high severity. An attacker can exploit it remotely via any network client that can reach the unsecured REST API; the lack of an authentication layer removes a barrier to exploitation. The EPSS score is not provided, so the exact likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Given the cleartext disclosure of authentication secrets, the potential impact ranges from compromised monitoring credentials to full unauthorized access to the monitoring stack.